WG
Vendor
wger-project
18
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-46438 | WG wger wger-project | 6.5 | Oct 7 | wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry |
| CVE-2026-46437 | WG wger wger-project | 4.8 | Oct 7 | wger: API credentials remain valid after logout/password change |
| CVE-2026-46434 | WG wger wger-project | 7.1 | Oct 7 | wger: Trainer Privilege Escalation - Improper Privilege Management |
| CVE-2026-45161 | WG wger wger-project | 5.4 | Oct 7 | wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding |
| CVE-2026-43976 | WG wger wger-project | 7.1 | Oct 7 | wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) |
| CVE-2026-86257 | WG wger wger-project | 5.4 | Sep 6 | wger before 2.6 CSV Formula Injection via member export |
| CVE-2026-86256 | WG wger wger-project | 5.4 | Sep 6 | wger before 2.6 Open Redirect via trainer-login next parameter |
| CVE-2026-86255 | WG wger wger-project | 6.5 | Sep 6 | wger before 2.5 Uncontrolled Resource Consumption via date_sequence |
| CVE-2026-86254 | WG wger wger-project | 6.8 | Sep 6 | wger Incomplete Authorization Fix Cross-Tenant Account Deletion |
| CVE-2026-82544 | WG wger wger-project | 4.3 | Aug 30 | wger-project wger Password Reset gym.py reset_user_password cross-site request forgery |
| CVE-2026-43977 | WG wger wger-project | 7.5 | Jul 16 | wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API |
| CVE-2026-43978 | WG wger wger-project | 8.1 | Jul 16 | wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers |
| CVE-2026-43948 | WG wger wger-project | 9.9 | May 12 | wger: cross-tenant password reset and plaintext disclosure via gym=None bypass |
| CVE-2026-40474 | WG wger wger-project | 7.6 | Apr 17 | wger has Broken Access Control in the Global Gym Configuration Update Endpoint |
| CVE-2026-40353 | WG wger wger-project | 5.4 | Apr 17 | wger: Stored XSS via Unescaped License Attribution Fields |
| CVE-2026-27839 | WG wger wger-project | 4.3 | Feb 26 | wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup |
| CVE-2026-27838 | WG wger wger-project | 3.5 | Feb 26 | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data |
| CVE-2026-27835 | WG wger wger-project | 4.3 | Feb 26 | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data |